Privacy policy

Who is the data controller?

The controller of your personal data is ANVAPOL Sp. z o.o., ul. Brzeska 170A, 21-500 Biała Podlaska, Poland, owner of the GRAF Ceilings & Walls brand. For matters concerning personal data, write to anvapol@interia.pl or call +48 575 300 941.

What data do we process?

Only the data you give us when you write or call about a quote, installation or service. From the form on the site: first name, phone number, e-mail address, service, town and property type (all these fields are required) and whatever you enter in the “Message” field.

Together with a form submission, we store in our enquiry database the technical data needed to handle the enquiry and to protect against abuse: IP address, browser name, language, screen size, time zone, the address of the page the form was sent from, the referring page and the time taken to fill in the form. If you consent to the cookie, also the visit identifier, the entry page with campaign parameters (UTM), the date of your first visit and the number of visits.

With your consent (cookie banner) we also record how you use the site: which pages you view, what you click on, how far you scroll, how long you spend in each section, whether you use the light slider and which form fields you fill in (without the contents of the fields). This data is linked to a random identifier from the cookie, not to your name, until you send the form. It is used solely to improve the site; we do not pass it on to anyone and do not combine it with data from other services.

• First name, phone number, e-mail address.
• Place of installation (town), property type and the service you are asking about; the installation address when we book a site survey.
• Photos, plans and other files you send for a quote.
• The content of our correspondence, including on WhatsApp.

The site's server keeps standard connection logs, that is the IP address, time of access, address of the page requested and browser name. The logs are used to detect abuse and are deleted after 30 days.

For what purpose and on what basis do we process data?

• Responding to your enquiry, preparing a quote and contract, and carrying out the installation. The legal basis is Art. 6(1)(b) GDPR, that is steps taken before entering into a contract and performance of the contract.
• Service and guarantee after installation, and tax and accounting obligations. The legal basis is Art. 6(1)(c) GDPR.
• Security of the site and server. The legal basis is Art. 6(1)(f) GDPR, that is our legitimate interest.
• Contact about new offers, only if you consent to it. The legal basis is Art. 6(1)(a) GDPR, and you can withdraw your consent at any time.

Who do we share data with?

Companies that run our server, e-mail and messaging services, to the extent needed for that. Form submissions reach our team through the Telegram messenger (Telegram Messenger Inc.), and a copy is stored on our server.

• The hosting provider of the server the site runs on.
• Google and Interia, our e-mail providers, when you write to us by e-mail.
• Meta Platforms Ireland, when you choose to contact us via WhatsApp.

We do not sell data or share it with advertisers.

How long do we keep data?

• Form enquiries in our database for 24 months from sending, unless you ask for deletion sooner.
• Contract data for the duration of the guarantee and for the period required by tax law.
• Data processed on the basis of consent until the consent is withdrawn.
• Blocks after form abuse (IP address, phone number, e-mail) for 7 days.
• Server logs for 30 days, the graf_v cookie for 12 months, site usage data for 13 months.

Does the site use cookies?

Only our own, and only with your consent. Until you make a choice in the banner, the site stores nothing in your browser. We use no analytics or advertising tools and load no scripts from third-party servers.

• graf_zgoda: remembers your choice in the banner (consent or refusal), 12 months. It is necessary so that we don't ask you on every visit.
• graf_v: stored only after you choose “I agree”. It contains a random identifier, the address of the page through which you entered sufitynapinane.eu (with campaign parameters, if any), the date of your first visit and the number of visits. It lets us record how you use the site (pages, clicks, scrolling, time) and know where an enquiry came from. 12 months.

The legal basis is your consent (Art. 6(1)(a) GDPR and the provisions of the Polish Electronic Communications Act). You can withdraw consent at any time: click “Cookie settings” in the footer and choose “No, thanks”, and the graf_v cookie will be deleted.

What are your rights?

You have the rights provided for by the GDPR. To exercise them, write to the address given above and we will reply within a month.

• Access to your data and a copy of it.
• Rectification of your data.
• Erasure of your data.
• Restriction of processing.
• Data portability.
• Objection to processing based on our legitimate interest.
• Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• A complaint to the President of the Polish Personal Data Protection Office (UODO).

Do you have to provide data?

Providing data is voluntary. Without a phone number or e-mail address, however, we cannot answer your enquiry, and without information about the place of installation we cannot prepare a quote.

Are decisions made automatically?

We do not profile you or make decisions with legal effects. The only automated mechanism protects the form against abuse: more than two submissions from one IP address within 12 hours, or a third submission with the same phone number or e-mail within 7 days, means the form asks you to contact us by phone for 7 days. The submission is still saved, and a phone call is always possible.

How do we protect data?

The connection to the site is encrypted (HTTPS), and access to e-mail and the server is limited to the people who handle enquiries and the site.

When do we change the policy?

When the law changes or the way the site works changes, for example when visitor statistics are launched. The current version is always at sufitynapinane.eu/en/privacy-policy/, with the date at the top.